Back to skill

Security audit

Pharma Intelligence

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real pharma research skill, but it needs review because its helper scripts can make broadly scoped web requests and save fetched data to caller-chosen local file paths.

Install only if you are comfortable with a research skill that can run Python scripts making outbound HTTP requests and optionally writing raw API responses to local files. Prefer running it in a sandboxed environment, avoid passing untrusted JSON directly to the scripts, do not use save_raw or raw_output_path unless necessary, and review generated commands before execution.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (73)

Tainted flow: 'raw_text' from requests.post (line 109, network input) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Content
raw_text = json.dumps(data, indent=2)
        path = Path(config["raw_output_path"] or "/tmp/gnomad-graphql.json")
        path.parent.mkdir(parents=True, exist_ok=True)
        path.write_text(raw_text, encoding="utf-8")
        raw_output_path = str(path)

    if "errors" in data:
Confidence
92% confidence
Finding
path.write_text(raw_text, encoding="utf-8")

Tainted flow: 'raw_text' from requests.post (line 285, network input) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Content
)
        path = Path(config["raw_output_path"] or "/tmp/opentargets-associated-diseases.json")
        path.parent.mkdir(parents=True, exist_ok=True)
        path.write_text(raw_text, encoding="utf-8")
        raw_output_path = str(path)

    if disease_filter and not filtered_rows:
Confidence
93% confidence
Finding
path.write_text(raw_text, encoding="utf-8")

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill advertises extensive use of networked sub-skills and browser/web retrieval, but the file shows no explicit permission declaration or capability scoping despite indicating env, file read/write, and network-adjacent behavior. In an agent setting, undeclared capabilities reduce transparency and can allow broader-than-expected access paths, making review, sandboxing, and least-privilege enforcement harder.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill claims a bounded pharmaceutical intelligence purpose, but the analysis indicates broader generic REST/GraphQL access and local file writing that go beyond the stated function. That mismatch is dangerous because users and orchestrators may trust the manifest description while the implementation can exfiltrate data to arbitrary endpoints, query unrelated resources, or persist sensitive remote content locally.

Context-Inappropriate Capability

Low
Confidence
74% confidence
Finding
The skill directs the agent to use browser automation as a fallback even though the manifest describes source retrieval rather than interactive browsing. Hidden escalation from fetch to browser automation increases attack surface because browser tools may execute client-side code, follow redirects, expose session context, or interact with more dynamic content than expected.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill file is narrowly scoped to bioRxiv/medRxiv preprint metadata retrieval, while the surrounding metadata frames it as part of a much broader pharmaceutical intelligence capability. This kind of scope mismatch can cause an agent to route sensitive or high-stakes biomedical questions to a tool that lacks the claimed coverage, producing incomplete or misleading source-grounded answers and weakening trust boundaries around tool selection.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The client builds the request URL from user-controlled `base_url` and `path`, and explicitly allows fully qualified URLs in `path`, enabling arbitrary outbound HTTP requests. In a skill advertised as domain-specific pharma intelligence, this overbroad network capability creates SSRF-style abuse potential, data exfiltration pathways, and access to unintended internal or third-party services.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code can write raw HTTP responses to an arbitrary filesystem path via `raw_output_path`, with directory creation enabled and no path restrictions. This permits unintended local file writes, persistence of sensitive fetched data, and possible overwriting of files accessible to the process, which is unnecessary for the stated research function.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file defines a ChEBI-only chemical lookup skill, but it is being evaluated under a broader pharma-intelligence skill context. This mismatch can cause incorrect tool routing, incomplete evidence gathering, and overreliance on a narrow data source for regulatory, clinical, or competitive-intelligence questions, producing materially misleading outputs in security- or safety-relevant biomedical workflows.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The client accepts fully qualified URLs in `path`, allowing requests to arbitrary hosts rather than being constrained to an expected API domain. In an agent skill, this becomes an SSRF-style capability and broad data-exfiltration primitive because attacker-controlled inputs can direct the tool to internal services, cloud metadata endpoints, or unrelated external systems.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code can write raw remote responses to an arbitrary filesystem path supplied in input, which grants unnecessary file-write capability to a network-fetch tool. This can leak sensitive fetched data to persistent local storage, overwrite important files writable by the process, or create staging files later consumed by other components.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The client accepts a caller-controlled `base_url` and permits absolute URLs in `path`, allowing requests to arbitrary destinations rather than a fixed set of pharma data providers. In an agent context, this creates SSRF and data-exfiltration risk because the skill can be repurposed to contact internal services, cloud metadata endpoints, or attacker-controlled hosts unrelated to its stated purpose.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
`save_raw` combined with caller-supplied `raw_output_path` allows arbitrary response data to be written to attacker-chosen filesystem paths. This can overwrite files accessible to the process, persist sensitive data, or plant content in locations later consumed by other tools or users.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file advertises a narrowly scoped ClinicalTrials.gov skill, while the surrounding skill metadata claims a much broader pharmaceutical intelligence capability. This mismatch can cause an orchestrator or user to over-trust the skill for multi-region regulatory, pipeline, patent, or bioactivity tasks that it cannot actually perform, leading to incomplete or misleading outputs presented as authoritative research.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The helper will write raw API responses to an arbitrary filesystem path supplied by the caller, with parent directories auto-created. In an agent/skill environment, this creates an unintended file-write primitive that is unrelated to the stated pharma intelligence purpose and could overwrite application files, drop data in sensitive locations, or facilitate follow-on attacks depending on the runtime's filesystem permissions.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script can persist full raw API responses to local storage via `save_raw`, which is not necessary for a simple lookup helper and creates data-retention risk. Even if the upstream data is public, writing arbitrary fetched content to disk can expose sensitive query context, leave unnecessary artifacts, and expand the skill's capability beyond read-only search behavior.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
`raw_output_path` is user-controlled and passed directly to `Path(...).write_text(...)`, allowing arbitrary file writes anywhere the process has permission. This can overwrite application files, drop artifacts in sensitive locations, or be chained with other weaknesses for persistence or disruption.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The helper accepts absolute http/https URLs in `path`, which bypasses the supplied `base_url` and turns the script into a generic outbound HTTP client. In a skill intended for biomedical/pharma research, this materially broadens capability and can enable SSRF-style access to unintended internal or external services, exfiltration to attacker-controlled endpoints, or use against non-approved domains.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
`_save_raw_output` writes server responses to an attacker-influenced filesystem path (`raw_output_path`) or to `/tmp` by default, giving the skill unnecessary local file write capability. Even though it writes response content rather than arbitrary code, this can persist sensitive data, overwrite files accessible to the process, or be abused for lateral effects in shared environments.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This code implements a fully generic HTTP client driven by user-supplied base URL, path, headers, method, and body rather than a constrained pharma-specific integration. In a skill context, that materially expands capability to arbitrary outbound requests, creating SSRF/data-exfiltration and policy-bypass risk if untrusted input can reach this script.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The raw-output save helper writes server-controlled response content to an arbitrary caller-provided filesystem path. That enables unintended local data persistence, overwriting of writable files, and storage of sensitive remote content outside the skill’s expected workflow.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The client supports both arbitrary local file reads through `query_path` and arbitrary local file writes through `raw_output_path`, which is broader than its stated purpose of issuing GraphQL requests. In an agent/skill context, exposing generic filesystem access increases the chance of sensitive local data disclosure or unauthorized file modification if an upstream caller can influence inputs.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The `save_raw` feature permits writing full API responses to any path specified by the caller, without confinement to a safe workspace. In a skill intended for pharmaceutical intelligence, that extra filesystem capability is not clearly necessary and can be abused to overwrite files, drop artifacts, or store potentially sensitive data outside expected locations.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
This script is a fully generic HTTP client: it accepts arbitrary base URLs, paths, headers, query parameters, methods, and request bodies, then performs outbound requests and can save raw responses to attacker-controlled file paths. In an agent/skill context, that creates an SSRF and data-exfiltration primitive that exceeds the stated GWAS/pharma purpose, enabling access to internal services or unintended external destinations if upstream inputs are influenced by users or prompts.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The helper writes raw network response data to a caller-controlled filesystem path without constraining the destination. In a broader agent runtime, this can be abused to overwrite arbitrary writable files, plant data in sensitive locations, or stage follow-on attacks unrelated to the skill's stated pharma research purpose.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.